From: William Lallemand <wlallemand@irq6.net>
Date: Tue, 3 Nov 2026 16:53:09 +0000 (+0000)
Subject: BUG/MEDIUM: ssl/cli: don't unlock the certificate lock after a failed trylock
X-Git-Tag: v3.5-dev11~50
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=7363d51c267705111758d9b767bdbfe6cf6257e3;p=haproxy.git

BUG/MEDIUM: ssl/cli: don't unlock the certificate lock after a failed trylock

When ckch_store_load_payload() fails to acquire ckch_lock, it jumps to
the common cleanup path, which unconditionally releases the lock. This
unlocks another operation's lock and returns success because errcode is
still zero. When the actual owner subsequently unlocks, the lock state
underflows and later certificate commands remain blocked.

Return ERR_ALERT | ERR_FATAL immediately on failed lock acquisition. No
temporary resources have been allocated at this point, so cleanup is
unnecessary.

This regression was introduced in 3.4-dev11 by commit efe6c97488, which
extracted ckch_store_load_payload() from the CLI parser. This fix should
be backported to 3.4 only. Versions 3.3 and older return directly on
failed lock acquisition and are not affected.
---

diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c
index 2c33bfe4b..78044e2f2 100644
--- a/src/ssl_ckch.c
+++ b/src/ssl_ckch.c
@@ -3221,7 +3221,7 @@ int ckch_store_load_payload(char *path, char *payload, char **err)
 	 * manipulate ckch_store and ckch_inst */
 	if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock)) {
 		memprintf(err, "Can't update the certificate!\nOperations on certificates are currently locked!\n");
-		goto end;
+		return ERR_ALERT | ERR_FATAL;
 	}
 
 	pathbuf = alloc_trash_chunk();